dsh-deeppilot 0.6.2 → 0.7.1

package/COMPATIBILITY.md

@@ -7,7 +7,7 @@ This file separates tested evidence from intended behavior. Passing unit tests d
 | Component | Baseline | Evidence |
 |---|---|---|
 | Node.js | 22 or newer | package engine and CI |
-| DSH CLI and Host API | `0.1.5-rc.1` minimum for plugin `0.6.x` | rc.1 package-family typecheck/build; bridge and `/phone` protocol tests |
+| DSH CLI and Host API | the `0.1.5-rc.*` and `0.1.6-*`/`0.1.6` lines, `0.1.5-rc.1` minimum, for plugin `0.7.x` | plugin source typecheck, unit suite (265 tests) and `tsdown` build run against the `0.1.5-rc.2`, `0.1.6-alpha.1` and `0.1.6-alpha.2` package families; the `deeppilot/report` contribution registered through both the `0.1.6-alpha.1` and the `0.1.6-alpha.2` `TypertRegistry`; bridge and `/phone` protocol tests |
 | Host OS | macOS, Linux, Windows on packaged amd64/arm64 helper targets | helper checksums plus user-confirmed Windows/Linux Funnel launch and connection; local LAN validation remains part of alpha testing |
 | Remote access | Tailscale Funnel, ports 443/8443/10000 | helper and supervisor tests |
 | iOS | native DeepPilot client, protocol v2 | simulator build and v2 pairing/challenge evidence |
@@ -15,11 +15,50 @@ This file separates tested evidence from intended behavior. Passing unit tests d
 ## Protocol boundary
 
 - Protocol v2 is the only supported wire version. Existing protocol-v1 devices must pair again after upgrading.
+- The pairing QR now encodes a `deeppilot://pair` link, and the settings page shows that same string in one copy field. An app build that predates the link only parses the JSON payload, so it must be updated before pairing against this plugin; a link pasted into an older app is rejected instead of being half-applied. The current app still accepts the JSON payload.
+- Plugin `0.7.x` serves the LAN listener over self-signed TLS only; devices paired over LAN with `0.6.x` or older must pair again so the app receives the certificate fingerprint. The DSH web server no longer carries `/phone` compatibility routes. Funnel pairings are unaffected.
 - Bearer authentication, URL credentials, and first-frame shared tokens are rejected. A supported client registers a P-256 public key through `/phone/pair` and signs each WebSocket challenge.
 - Without a compatible embedded helper, the core bridge and trusted-LAN mode can still run; remote Funnel reports `unavailable`.
 - If a DSH Host API is missing, only the dependent capability should be disabled. The plugin must not crash the Host.
-- Plugin `0.6.x` requires DSH `0.1.5-rc.1` or newer. Older plugin
-  versions used developer-preview DSH builds and remain historical artifacts.
+- Plugin `0.7.x` requires DSH `0.1.5-rc.1` or newer within the `0.1.x` line.
+  Older plugin versions used developer-preview DSH builds and remain historical
+  artifacts.
+- The declared peer range is a disjunction,
+  `^0.1.5-rc.1 || >=0.1.6-alpha.1 <0.2.0-0`, because npm's prerelease rule only
+  lets a prerelease version satisfy a range whose comparators carry a
+  prerelease on the same `major.minor.patch` tuple. Neither `^0.1.5-rc.1` nor
+  `>=0.1.5-rc.1` alone admits a `0.1.6` prerelease. `tests/compatibility-metadata.test.ts`
+  asserts the range admits `0.1.5-rc.1`, `0.1.5-rc.2`, `0.1.6-alpha.1`,
+  `0.1.6-beta.1` and `0.1.6`, and rejects `0.2.0`.
+- DSH `0.1.6-alpha.1` replaced `agent/session-start` with `agent/created`,
+  deprecated the synchronous `snapshotEvents`/`eventAt`/`ownEvents` history
+  readers, and renamed the PTC packages to the `ptc-runtime` family. The plugin
+  uses none of those surfaces: every host dependency is resolved structurally
+  from the Cordis context (`sessionController`, `workspaceController`,
+  `directoryPickerController`, `sessionProjections`) and the `session/event`
+  and `api-session/*` events, all of which kept their `0.1.5-rc` shape.
+- DSH `0.1.6-alpha.2` changed the strict codec shape carried by an
+  `InvocationDescriptor`. Through `0.1.6-alpha.1` a descriptor published the
+  schema value itself and every consumer called `codec.schema.parse(value)`;
+  `alpha.2` instead validates a lazy `create()` factory at registration and the
+  Gateway parses through `codec.create().parse(value)`. A codec carrying only
+  `schema` is rejected by the `alpha.2` registry
+  (`typert: … strict codec has no create() factory`), which aborts plugin
+  activation. One `strictCodec()` helper in `src/report-wire.ts` emits both
+  keys — the same hand-written, dependency-free codec — so a single published
+  package registers and parses on either generation, and
+  `tests/report-wire.test.ts` pins both access paths.
+  The other `alpha.2` Typert change — a contributed schema's materialized
+  `schema` becoming a lazy `create()` factory — does not apply here: this
+  Remote contributes no schemas, which the same test asserts.
+- DSH `0.1.6-alpha.2` made runtime plugin removal real, through both the
+  Plugin Manager and the client entry reconciler. Every long-lived resource is
+  registered through `ctx.effect`, and the settings-page stylesheet stamps
+  `data-plugin="dsh-deeppilot"` so the module system's `removeOwnedStyles()`
+  can delete it; the module system only auto-claims styles present during
+  factory materialization, while this sheet is injected from `apply()`.
+  Without that stamp, disabling the plugin would leave its sheet styling the
+  page.
 - The compatibility facade converts the
   current Session controller's raw event arrays into the stable wrapped
   history entries consumed by the phone bridge. Sessions persisted by earlier
@@ -31,8 +70,8 @@ This file separates tested evidence from intended behavior. Passing unit tests d
 
 - Intel macOS support for the embedded helper;
 - signed/notarized helper distribution;
-- repair or migration of persisted history rejected by the `0.1.5-rc.1`
-  Host's own session reader;
+- repair or migration of persisted history rejected by the Host's own session
+  reader;
 - every DSH developer-preview revision;
 - physical-device performance and every carrier/network combination;
 - production APNs delivery without a real provider credential and device.

package/README.md

@@ -22,7 +22,8 @@ Host on your own Mac and does not replace or modify the DSH Web UI.
 - Send prompts, switch models, create sessions, and answer approvals/questions.
 - Pair with a five-minute single-use code and a per-device P-256 key; physical
   iPhones keep the private key in Secure Enclave.
-- Connect over a trusted LAN or the optional embedded Tailscale Funnel.
+- Connect over the LAN (TLS with a Host-issued certificate pinned during
+  pairing) or the optional embedded Tailscale Funnel.
 - Receive live notifications and optional APNs notifications while offline.
 - Self-update hint: the settings page footer shows the installed plugin
   version, with an inline "new version" link to the matching GitHub
@@ -37,10 +38,11 @@ does not require the helper.
 
 | Plugin version | Required DSH | How to install |
 |---|---|---|
-| `0.6.x` (current stable, `latest`) | DSH `0.1.5-rc.1` or newer | `dsh plugin --profile web add dsh-deeppilot` |
-| `0.5.x` (previous stable) | DSH `0.1.1-rc.2`–`0.1.2-alpha.1` | `dsh plugin --profile web add dsh-deeppilot@0.5.0` |
+| `0.7.x` (current stable, `latest`) | DSH `0.1.5-rc.1` or newer | `dsh plugin --profile web add dsh-deeppilot` |
+| `0.6.x` (previous stable) | DSH `0.1.5-rc.1` or newer | `dsh plugin --profile web add dsh-deeppilot@0.6.2` |
+| `0.5.x` (legacy) | DSH `0.1.1-rc.2`–`0.1.2-alpha.1` | `dsh plugin --profile web add dsh-deeppilot@0.5.0` |
 
-`0.6.x` is built and typechecked against the DSH
+`0.7.x` is built and typechecked against the DSH
 [0.1.5-rc.1](https://www.npmjs.com/package/@deepseek-ai/dsh/v/0.1.5-rc.1)
 Host and client package family. It uses the Gateway multi-client Remote Events
 routing that keeps Web and DeepPilot independently answerable. Earlier plugin
@@ -56,13 +58,25 @@ dsh web
 ```
 
 After DSH restarts, open **Settings → DeepPilot**, enable the connection, show
-the pairing QR code, and scan it in the DeepPilot app. The same panel also
-shows a copyable pairing code for Simulator or manual entry.
-
-LAN access is enabled by default on the plugin's independent TCP port `3098`.
-DSH may continue listening only on `127.0.0.1:3080`; do not expose the full DSH
-web server. If a firewall is enabled, allow inbound TCP `3098` on trusted
-private networks. The port can be changed under **Advanced settings**.
+the pairing QR code, and scan it in the DeepPilot app. Below the QR code the same
+panel shows one copyable piece of pairing info (address, single-use code and
+certificate fingerprint) that can be pasted into the app in one step — useful for
+Simulator or when the camera is unavailable. Switching between the LAN and
+public address issues a matching new QR code and string immediately, with the
+panel staying open.
+
+LAN access is enabled by default on the plugin's independent TCP port `3098`
+and is TLS-only. The plugin generates a self-signed certificate on first start
+(key under `$DSH_HOME/deeppilot/lan-tls/`), and the pairing QR code carries its
+public-key fingerprint so the app pins that exact Host. DSH may continue
+listening only on `127.0.0.1:3080`; the plugin no longer registers any `/phone`
+routes on the DSH web server. If a firewall is enabled, allow inbound TCP
+`3098` on the networks you use. The port can be changed under **Advanced
+settings**.
+
+Upgrading from a plugin version that served plain `ws://` on the LAN: devices
+paired over the LAN must pair again so they receive the certificate
+fingerprint. Devices paired through Funnel are unaffected.
 
 Package: [npmjs.com/package/dsh-deeppilot](https://www.npmjs.com/package/dsh-deeppilot)
 
@@ -78,14 +92,15 @@ DeepPilot state under `$DSH_HOME/deeppilot/`.
 
 ## Publishing (maintainers)
 
-`0.6.x` targets DSH `0.1.5-rc.1`+; `0.5.x` stays compatible with
-DSH `0.1.1-rc.2`–`0.1.2-alpha.1`. Keep both published:
+`0.7.x` targets DSH `0.1.5-rc.1`+; `0.6.x` keeps the pre-TLS LAN transport for
+the same DSH family during the migration window, and `0.5.x` stays compatible
+with DSH `0.1.1-rc.2`–`0.1.2-alpha.1`. Keep them published:
 
 1. Bump `version` in `package.json` and in the root `""` entry of
    `package-lock.json`, then run `npm test && npm run typecheck && npm run build`
    and inspect `npm pack --dry-run --json` (the check
-   `tests/compatibility-metadata.test.ts` enforces the `^0.1.5-rc.1` peer
-   ranges).
+   `tests/compatibility-metadata.test.ts` enforces the peer range and asserts it
+   admits both the `0.1.5-rc.*` and the `0.1.6-*` lines).
 2. Commit the release and push it. `npm publish` runs `prepack` (build) and
    `prepublishOnly` (test + typecheck) automatically.
 3. Publish pre-releases without touching `latest`:
@@ -95,7 +110,7 @@ DSH `0.1.1-rc.2`–`0.1.2-alpha.1`. Keep both published:
    ```
 
    After a successful publish, `npm view dsh-deeppilot dist-tags --json` shows
-   `"latest": "0.6.x"` and `"alpha": "0.6.x-alpha.y"`. Verify the published
+   `"latest": "0.7.x"` and `"alpha": "0.7.x-alpha.y"`. Verify the published
    package by installing it into a DSH `0.1.5-rc.1` profile before pointing
    users at it.
 4. Tag the release commit `vX.Y.Z` and prepare a GitHub Release
@@ -109,11 +124,12 @@ Never run `npm publish` from a copy that still has an older version.
 
 ## Connection and privacy
 
-Conversation traffic travels directly between the iPhone and your DSH Host.
-Trusted-LAN `ws://` traffic on the independent plugin port `3098` is
-unencrypted, so use it only on a network you trust. Both the LAN listener and
-optional Funnel mode expose only the DeepPilot connection, one-time pairing,
-and health endpoints, not the complete DSH Web UI.
+Conversation traffic travels directly between the iPhone and your DSH Host and
+is always encrypted: the LAN listener on port `3098` serves TLS with a
+self-signed certificate whose fingerprint the app receives during pairing, and
+Funnel mode uses Tailscale-issued certificates. The app refuses plain `ws://`.
+Both the LAN listener and optional Funnel mode expose only the DeepPilot
+connection, one-time pairing, and health endpoints, not the complete DSH Web UI.
 
 The DeepPilot settings page exposes **Connections per public source** under
 the collapsed **Advanced settings** section. It defaults to `8`, accepts

package/README.zh-CN.md

@@ -21,7 +21,8 @@
 - 发送提示词、切换模型、创建会话，并处理审批与提问；
 - 使用 5 分钟有效的单次配对码与设备级 P-256 密钥；iPhone 真机私钥保存在
   Secure Enclave；
-- 使用可信局域网，或可选的内嵌 Tailscale Funnel 远程连接；
+- 局域网连接全程 TLS：插件自签证书，App 按配对二维码中的指纹固定信任；
+  也可选用内嵌 Tailscale Funnel 远程连接；
 - 接收在线通知，以及可选的离线 APNs 推送；
 - 更新提示：设置页底部显示当前插件版本，并在有新版本时附加一个指向
   对应 GitHub Release 的链接（后台静默检查，仅比较稳定版，不引入第
@@ -34,10 +35,11 @@
 
 | 插件版本 | 所需 DSH | 安装命令 |
 |---|---|---|
-| `0.6.x`（当前稳定版，`latest`） | DSH `0.1.5-rc.1` 或更高 | `dsh plugin --profile web add dsh-deeppilot` |
-| `0.5.x`（旧版稳定版） | DSH `0.1.1-rc.2`–`0.1.2-alpha.1` | `dsh plugin --profile web add dsh-deeppilot@0.5.0` |
+| `0.7.x`（当前稳定版，`latest`） | DSH `0.1.5-rc.1` 或更高 | `dsh plugin --profile web add dsh-deeppilot` |
+| `0.6.x`（旧版稳定版） | DSH `0.1.5-rc.1` 或更高 | `dsh plugin --profile web add dsh-deeppilot@0.6.2` |
+| `0.5.x`（历史版本） | DSH `0.1.1-rc.2`–`0.1.2-alpha.1` | `dsh plugin --profile web add dsh-deeppilot@0.5.0` |
 
-`0.6.x` 基于 DSH
+`0.7.x` 基于 DSH
 [0.1.5-rc.1](https://www.npmjs.com/package/@deepseek-ai/dsh/v/0.1.5-rc.1)
 的 Host 与 client 包族构建并完成类型检查。它使用 Gateway 多 Client Remote Events
 路由，使 Web 与 DeepPilot 能独立处理同一交互。旧 alpha 仅保留为历史产物；安装
@@ -52,11 +54,18 @@ dsh web
 ```
 
 DSH 重启后，打开 **设置 → DeepPilot**，启用连接并显示配对二维码，然后在
-DeepPilot App 中扫码。同一面板也会显示可复制的配对码，供模拟器或手动输入使用。
+DeepPilot App 中扫码。二维码下方同时显示一段可复制的「配对信息」（含地址、一次性配对码
+与证书指纹），在 App 里粘贴一次即可完成配对，适合模拟器或相机不可用时使用；在「内网 /
+公网」之间切换会立即为所选地址生成新的二维码与配对信息，面板保持展开。
 
-局域网连接默认使用插件独立的 TCP `3098` 端口。DSH 可以继续只监听
-`127.0.0.1:3080`，无需向局域网暴露完整 DSH Web 服务。启用系统防火墙时，请仅在
-可信私有网络放行入站 TCP `3098`；端口可在“高级设置”中修改。
+局域网连接默认使用插件独立的 TCP `3098` 端口，且只提供 TLS。插件首次启动时生成
+自签证书（私钥位于 `$DSH_HOME/deeppilot/lan-tls/`），配对二维码携带其公钥指纹，
+App 只信任与该指纹一致的主机。DSH 可以继续只监听 `127.0.0.1:3080`；插件不再在
+DSH Web 服务上注册任何 `/phone` 路由。启用系统防火墙时，请仅在你使用的网络放行
+入站 TCP `3098`；端口可在“高级设置”中修改。
+
+从仍在局域网提供明文 `ws://` 的旧版本插件升级：通过局域网配对的设备需要重新扫码
+配对，以接收证书指纹；经 Funnel 配对的设备不受影响。
 
 npm 包：[npmjs.com/package/dsh-deeppilot](https://www.npmjs.com/package/dsh-deeppilot)
 
@@ -71,13 +80,14 @@ dsh plugin --profile web remove dsh-deeppilot
 
 ## 发布说明（维护者）
 
-`0.6.x` 面向 DSH `0.1.5-rc.1`+；`0.5.x` 保持兼容 DSH
-`0.1.1-rc.2`–`0.1.2-alpha.1`，两个版本线都要保持发布：
+`0.7.x` 面向 DSH `0.1.5-rc.1`+；`0.6.x` 在同一 DSH 版本族上保留 TLS 化之前的
+局域网传输，供迁移期使用；`0.5.x` 保持兼容 DSH
+`0.1.1-rc.2`–`0.1.2-alpha.1`，各版本线都要保持发布：
 
 1. 同步修改 `package.json` 与 `package-lock.json` 根 `""` 条目中的
    `version`，然后运行 `npm test && npm run typecheck && npm run build`，
    并检查 `npm pack --dry-run --json`（`tests/compatibility-metadata.test.ts`
-   会强制校验 `^0.1.5-rc.1` 的 peer 范围）。
+   会强制校验 peer 范围，并断言它同时接纳 `0.1.5-rc.*` 与 `0.1.6-*` 两条线）。
 2. 提交发布并推送。`npm publish` 会自动执行 `prepack`（构建）与
    `prepublishOnly`（测试 + 类型检查）。
 3. 发布预发布版本，不要动 `latest`：
@@ -87,7 +97,7 @@ dsh plugin --profile web remove dsh-deeppilot
    ```
 
    发布成功后，`npm view dsh-deeppilot dist-tags --json` 应显示
-   `"latest": "0.6.x"` 与 `"alpha": "0.6.x-alpha.y"`。向用户推荐前，请先在
+   `"latest": "0.7.x"` 与 `"alpha": "0.7.x-alpha.y"`。向用户推荐前，请先在
    DSH `0.1.5-rc.1` profile 中安装验证发布的包。
 4. 为发布提交打 `vX.Y.Z` tag，并准备包含英文与简体中文说明的
    GitHub Release，链接本 README 的发布说明。
@@ -99,8 +109,9 @@ dsh plugin --profile web remove dsh-deeppilot
 
 ## 连接与隐私
 
-完整会话流量由 iPhone 直接连接用户自己的 DSH Host。插件独立 `3098` 端口上的
-可信局域网 `ws://` 是明文流量，只应在可信网络使用。局域网监听器和可选 Funnel
+完整会话流量由 iPhone 直接连接用户自己的 DSH Host，且始终加密：独立 `3098`
+端口的局域网监听器使用自签证书提供 TLS，指纹在配对时下发给 App；Funnel 模式
+使用 Tailscale 签发的证书。App 拒绝明文 `ws://`。局域网监听器和可选 Funnel
 模式都只暴露经过认证的 DeepPilot 连接、单次配对与健康检查端点，不会暴露完整
 DSH Web UI。
 

package/SECURITY.md

@@ -17,7 +17,7 @@ Do not open a public issue containing pairing codes, APNs device tokens, provide
 - Protocol v1, shared Bearer tokens, query credentials, and `c2s.hello.auth` are not accepted. There is no remote downgrade switch.
 - The server enforces explicit protocol scopes, while the normal settings UI grants the default scope set and exposes only the global connection switch plus per-device deletion. Deleting a device disconnects it immediately.
 - The canonical `$DSH_HOME/deeppilot` directory is repaired to mode `0700`. `host-id` and `devices-v2.json` are owner-only.
-- LAN `ws://` on the independent plugin port (default `3098`) is unencrypted. Use it only on a trusted network and never forward that port to the public Internet. Public access should use Funnel HTTPS/WSS.
+- The independent LAN listener (default port `3098`) is TLS-only: the plugin serves a self-signed EC P-256 certificate, and the app pins its SPKI fingerprint delivered inside the pairing QR. There is no trust-on-first-use; a regenerated key forces re-pairing. The private key lives owner-only under `$DSH_HOME/deeppilot/lan-tls/`. Never forward the LAN port to the public Internet; public access should use Funnel HTTPS/WSS.
 - The LAN listener and Funnel helper publish only `/phone`, `/phone/pair`, and `/phone/health`, never the complete DSH Web UI.
 - Logs must never include pairing codes, key material, APNs tokens, or message bodies.